normalize user input

VIBE/CHAT_LOG.md

@@ -830,3 +830,9 @@ Change the title of the field “One-time password” to “One-time password (w
 
 ### Assistant outcome
 Updated the OTP field label in the English, Spanish, German, French, and Dutch extension locale catalogs to clarify that the code is needed only when OTP is configured.
+
+### User
+Remove any leading and trailing spaces when entering fields in the plugin settings page.
+
+### Assistant outcome
+The extension now trims leading and trailing whitespace from the backend URL, username, and OTP before validation, login, and storage. Password input is preserved exactly so intentional password characters are not changed.

VIBE/PROMPTS.md

@@ -147,6 +147,7 @@
 138. When the user is not logged in then the plugin should just display no form fields but warn the user that they have to log in with a link to settings.
 139. Remove DEFAULT_BACKEND setting in the plugin.
 140. Change the title of the field "One-time password" to "One-time password (when configured)".
+141. Remove any leading and trailing spaces when entering fields in the settings page of the plugin.
 
 ## Future entries
 

webextension/options.js

@@ -63,6 +63,7 @@ async function saveSettingsAndLogin(event) {
   const backendUrl = backendUrlInput.value.trim();
   const username = usernameInput.value.trim();
   const password = passwordInput.value;
+  const otp = otpInput.value.trim();
 
   if (!backendUrl || !username || !password) {
     setStatus(t('fillAllFields'), true);
@@ -73,7 +74,7 @@ async function saveSettingsAndLogin(event) {
     const response = await fetch(`${backendUrl}/api/auth/login`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username, password, otp: otpInput.value.trim() || null })
+      body: JSON.stringify({ username, password, otp: otp || null })
     });
 
     if (!response.ok) {